2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
Size

92KB
MD5

b24bf480729925279c47b3f83b179a1d
SHA1

1c445b09667f01affb5b0cee72ecef4200455a21
SHA256

2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a
SHA512

c6d392fce063e258eb4e71c39b6c9e4e2e019f5e765a32fbe19953f95754c2fc360a819a940437e510564eb8a5ed1a63f447f5c5c28fbfe346f35c1d2eab8d01
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNT:6rWpcOPxPke+e3fFpsJOfFpsJbgE5

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3635) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\MeasureDebug.xlsx.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMC.exe.mui.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jre7\lib\logging.properties.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\VideoLAN\VLC\README.txt.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Windows Defender\MsMpCom.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_rainy.png.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Linq.Resources.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp	2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe

C:\Users\Admin\AppData\Local\Temp\2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe
"C:\Users\Admin\AppData\Local\Temp\2e45589d454823f9b1d866f55018e90e3f724551c932753e6955f75c4b8f9a5a.exe"
1⤵
- Drops file in Program Files directory
PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
92KB

MD5
7ad998e1956d9246ba8314110c0a2aa7

SHA1
1b7691311e05f4d29690bbc5092a41fef093b16c

SHA256
3860f1f38755e78ccb8525112252e851fd2e2fbda18a92d8a2648746110a8a11

SHA512
55f9f9085f268fe7b0f74d2ccb68b4cde02cf52ecdacbc0aa3b8b888c045d85ff32e14c762bb57dec0a4faf51310ae464602cc913034e6ed07bcfd7f98fac5b6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
101KB

MD5
4fd2d8b4234280b7fe205010b5a66a6c

SHA1
7f492c2ecf14839259b81fc1b4b8ba365edf5d27

SHA256
66eea94313c6bf004a38c6b744f0db80bea250f0eba4734ad4319fafb5ec5e5f

SHA512
d39c8a62f379fbda3d5f365fb23570e3e513ae9744c4948d137f73a2c71d2c975a5cddb8a747c11a58733b03a7fed244f2d654df05e8a0f02074680e96a19ead

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads